Analysis
-
max time kernel
142s -
max time network
187s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
24-05-2024 15:44
General
-
Target
6f05479fe223584d78606b3fe3d1f0be_JaffaCakes118.apk
-
Size
13.0MB
-
MD5
6f05479fe223584d78606b3fe3d1f0be
-
SHA1
ca9cfd5226cb563b867235e323cb30daec331ff8
-
SHA256
5fe0d38c39ab6cb4c20d0a4b333c242aebed12e9a75138fcfe3ce8986ebc3c00
-
SHA512
2502f468374bade315a8aa2aca0dda9f5218cce2eef09abc733045a8d7bd3a8ec6ceab4e1d524e6b91cd85f4e4e7effc04ac0acf7a6a72f41f5684222e835b8b
-
SSDEEP
196608:8SOVpt3w7VZxDDAsiR5byIoSDe17SzI51CoRjGuvBa7nZvwUPlZuaSXJi:8pV2Pf4wSDal51CoRj/Q7n/PlZuS
Malware Config
Signatures
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about running processes on the device 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
-
Checks if the internet connection is available 1 TTPs 3 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
Processes
-
cn.it.picliu.fanyu.shuyou1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
getprop ro.product.cpu.abi2⤵
-
cn.it.picliu.fanyu.shuyou:channel1⤵
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
cn.it.picliu.fanyu.shuyou:TcmsService1⤵
- Requests cell location
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f5ae32aa1d107b065c2b758b7d8cc54e
SHA16f4c6201365aab1b4d6c1a1669213db716eaa1c1
SHA256d96bd17a72f054221436b1e049350c1a11ad752a4e2dda89019394efd248979a
SHA51235f7148afc30d4766733709af5daafe22c32039f358d2ef24cb9a1462e960141153ae95905b0516a15eb04c6f380445a52c381a0883e8f591f0711f3b7c6a6ea
-
Filesize
512B
MD5ee07aa9e91c865a74a99c9c0576e26ef
SHA138e755c857bd55f7c8ea4e585b9d4cc328f1fabb
SHA256fcdcd7ebb3eca1a207f9b88421fcd378b3e4e5803a991d99bc2b6eb2d5909413
SHA512fc11a144887a0cf94ababc4e2a4e0d2c97c4a46bb90482a2448283af49ce9279d910051fcd340a6c7d1fbd9e8d01972e93f5f19b3c39280c975430a5dacda20c
-
Filesize
32KB
MD5e7e483f847b0e711f68654125e90be81
SHA1b6a67b28d0525dfa22f2f637c9d6d05e440fdaef
SHA25623c8e89d9d4b201c39ea7fbae3b86c05763e4696e1553c429ecac3dfa67182ad
SHA512dfdd0c06ee3706110fa956bdcde91b897704f464b0339c8abf19b67808942bb92aec2b9e192635e873669428240d8c26bd526d60dc203b5ffe9d7ca8190a4126
-
Filesize
48KB
MD57095f77fb9cc65d6621364198e1760c7
SHA1ee541ee12e891c5ff9e59889adef1a99d81d7793
SHA25681f31b07751df7f6dab91aa2bb703089c4fb0b7cbd81e6cb92dc8b2551c29d3e
SHA51265e10d03ffc38945d3c0c514865bc7a4f812f251b6990bf95d398bea69f10af345866206a5c89bee461d4ddd4111c93de4acada841137e62c22acc29cd765f30
-
Filesize
4KB
MD5a673367cfae74db3ebad06d0487c32a8
SHA1eccdaec0143a0cb8bfc316674f1267ee1a2ae889
SHA2560db6751cc64b7d3d06d7ddc24df5cf6c17bc38cc688c66a518143d91709a2ee7
SHA5129ca4f70d0ff235f4620df91b8ae6221e9a89c1141fa7b139c86aaa895e2876e36bc3200c4bc48079aabf5414f11eb38abbd69701f42e896d0cf075a53b4bddd8
-
Filesize
512B
MD51529fb2924825c4cc115527ffb80160a
SHA1c15cef6c757d4e91edb2c64ba4d1db39bbeaadb5
SHA2567eb65e9d1cea32fe1c24d8171957d2f5b6697ec487f9c14f32d7698d768ba066
SHA512c51a9ee53ded1e58e0d6ee072bbd1a5bc43fc0ba886c024154901b922123a5cdd326390fb1e776f11cfadaf08b0920cc51924103cf479480ce953831b3e39671
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
32KB
MD5989910f088097bb5aa31b62d76a2ce55
SHA14ff32c4632a7a1776de429c4a8221425aa7a6183
SHA2561d15bba65264229e067660068987bc9e6dcbbdc1e4ba1b8f70c4421743f58739
SHA5122d80c946f083886a9356907819b935638fe8e3b1ead8fabf64168aaf4c9360cad6b03c76de2db44b80537cd7d949c8484809405afa23107c83f6da7881a6e7d8
-
Filesize
167B
MD5fb50570fb38132e7d098ff298339a3f7
SHA1dc363093fec77ee0be013c7dff8ac49ce3bea304
SHA2561addee95a2063ad82b530fceff17157b32a35e63aea08db9466e3624cbe43b65
SHA512556cbe746cf9f6a525647dd00ade1000a9b6e98951ac32bf7f3fc13e57a10f1c5eb3640d4d9c9f659c571ccd61851d5fc2b0516943a6774ca98f5353fd25f25c
-
Filesize
544B
MD59befb9bd2eaa903792f4d8cfa4abd6b3
SHA1e1ce5264215186795a19c05763fd339137a5eb92
SHA256c303d03d5193023e4e0e30f0ee00d0bd9d0cbe2df45d8a5d833e59c7ba8943a2
SHA51220321a9b023e509d42cb37f8d348f2bac1e3654e67208e8a80ade661f6ef712fac381c0802de6cd3c57a91ca25a4f68fa77821069b0e3f29eaa9c219db4d768a
-
Filesize
4KB
MD506fdfae5e9ee700d05fcc001a404478f
SHA1573b6ecb8c84ba0442c125f0e10608903cd37d3d
SHA2567a9d27f7a9c05ddb2ded1618ce12ec584886d3e865c2fa9cc6858febfafd8eff
SHA512824ffa8a59bf6a161abd0e3a4b53eeb43e80e6a6325641920da433c41cd85e8d155ac848d4ca4d1acdb93adaf7fe999f1566027dfc552e2ae1fd6bcce08b1945